Enables deterministic security testing of AI agents that use tools by serving synthetic MCP environments with poisoned data, fake secrets, and privileged actions. Records agent tool calls and evaluates security invariants (e.g., canary leaks, forbidden access, approval binding) without an LLM judge or real systems.
Runs isolated AI agents in Docker containers with persistent workspaces and conversation history. Each agent has access to file operations, shell commands, GitHub integration, and can connect to external MCP servers for additional tools.
